How to upgrade the Splunk App for Windows Infrastructure

Upgrade from version 1.0.x to version 1.0.3

If you have already installed version 1.0.x of the Splunk App for Windows Infrastructure, upgrade the app by installing it directly over the previous version. You can do this from within Splunk Web or from the command line.

How to upgrade from Splunk Web

To upgrade the Splunk App for Windows Infrastructure from within Splunk Web:

1. In the upper left corner, click "Apps > Manage Apps."

2. Locate the Splunk App for Windows Infrastructure in the list, and check the "Version" column. If an upgrade is available, Splunk Enterprise provides the opportunity to do the upgrade by displaying "Update to 1.0.3."

3. Click the "Update to 1.0.3" link. Splunk Enterprise loads the "App Update Available" page.

4. Click "Update." Splunk Enterprise loads the "Login required" page.

5. Enter your splunk.com login credentials, then click "Login." Splunk Enterprise upgrades the app, then presents the "Restart" page.

6. Click "Restart". Splunk Enterprise restarts, then returns you to the "Manage Apps" page.

7. In the upper left corner, click "Apps > Splunk App for Windows Infrastructure." Splunk Enterprise loads the updated app, then begins the first-time run process.

How to upgrade from the command line

To upgrade the Splunk App for Windows Infrastructure from the command line:

1. Download the updated Splunk App for Windows Infrastructure from Splunk Apps.

Note: The package downloads as a .tar.gz or .tgz file. Do not attempt to run this file.

2. On the Splunk Enterprise instance that runs the Splunk App for Windows Infrastructure, unpack the archive directly over the existing Splunk App for Windows Infrastructure directory:

tar xvzf splunk_app_windows_infrastructure_103.tar.gz -C $SPLUNK_HOME/etc/apps

Note: On Windows systems, use a file archive tool such as WinZip to extract the files.

3. Restart Splunk Enterprise on the instance that runs the app.

4. Log into Splunk.

5. In the upper left corner, click "Apps > Splunk App for Windows Infrastructure." Splunk Enterprise loads the updated app, then begins the first-time run process.

Troubleshoot permissions issues after an upgrade

When you upgrade the Splunk App for Windows Infrastructure to version 1.0.3, the app installs a new user role, winfra-admin. The Splunk user that uses the Splunk App for Windows Infrastructure must have this role, otherwise the app will not function correctly.

If, during the first time process, you see that the app does not find any data and you know that the data exists (such as in the case of an upgrade), be sure to add the winfra-admin role to the user that uses the app, as described in the troubleshooting page.